Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in @webapp-next/store (npm)

The npm package @webapp-next/store contained malicious code that executed automatically on installation, collecting system and user information and exfiltrating it to an attacker-controlled server. The package had no legitimate functionality and used a dependency-confusion lure with a scope resembling a legitimate namespace.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or system that installed @webapp-next/store via npm
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • @webapp-next/storenpm package containing malicious preinstall script

The npm package @webapp-next/store was published with malicious code designed to execute automatically during installation. The package.json declared a preinstall script that ran node index.js on npm install, triggering data exfiltration without user consent.

The index.js payload collected sensitive system and user information including hostname, platform, architecture, home directory, user credentials (username, uid, gid, shell), OS release/memory/CPU details, current working directory, and the output of shell commands whoami and id. This aggregated data was then POSTed to https://oia2jeijtfmt053ynp686t5riioac00p.oastify.com/testbydext, a Burp Suite Collaborator out-of-band interaction subdomain controlled by the attacker.

The package contained no legitimate functionality—only the exfiltration payload. The use of the @webapp-next scope, which resembles a legitimate namespace, combined with the lack of author/description metadata, indicates a dependency-confusion attack designed to lure developers into installing the malicious package.

The incident was identified and reported by the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • @webapp-next/store
Domains
  • oia2jeijtfmt053ynp686t5riioac00p.oastify.com

Remediation

  • Immediately uninstall @webapp-next/store from all systems and projects
  • Audit npm install logs to identify when the package was installed and on which systems
  • Assume any system that installed this package has been compromised; review for unauthorized access and data exfiltration
  • Change credentials (passwords, SSH keys, API tokens) for any user accounts on affected systems
  • Monitor network traffic from affected systems for suspicious outbound connections
  • Use npm audit to check for other malicious packages in your dependency tree
  • Consider using npm package signing verification and private registries to prevent dependency-confusion attacks

Sources

  1. GitHub Advisory GHSA-9frp-9f8j-wj97 · GitHub Advisory Database

Cite this entry

"Malicious code in @webapp-next/store (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-webapp-next-store-npm-a983us

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in sme-rko-finance-front-operations-notifications-impl (npm)

    The npm package sme-rko-finance-front-operations-notifications-impl contained malicious code that executed platform-specific payloads fetched from attacker-controlled infrastructure upon installation. The package used obfuscation and dependency-confusion tactics to evade detection and mimic internal naming conventions.

    npmCompromised packageDependency confusion
  2. containedcritical

    Malicious code in sme-rko-finance-front-payments-currency-payment-domain (npm)

    A malicious npm package named sme-rko-finance-front-payments-currency-payment-domain was published publicly, designed to mimic an internal corporate package name (dependency-confusion attack). On installation or import, the package executes arbitrary native code via multiple obfuscated loader mechanisms, establishing command-and-control communication through DNS TXT records and Cloudflare Workers.

    npmCompromised packageDependency confusion
  3. resolvedcritical

    Malicious code in consumerweb-creditcollection (npm)

    consumerweb-creditcollection@99.9.1 is a malicious npm package that uses dependency confusion to force installation of attacker-controlled code from a Google Cloud Storage bucket. The package exports an empty object but pulls in a dependency (ltidisafe) pinned to an arbitrary tarball URL outside the npm registry, bypassing security scanning.

    npmDependency confusionCompromised package
  4. resolvedcritical

    Malicious code in @united-airlines-org/atmos-design-system (npm)

    The npm package @united-airlines-org/atmos-design-system contains a malicious preinstall script that exfiltrates host reconnaissance data (hostname, directory listing, username) to an attacker-controlled endpoint. The package uses a scope name resembling an internal United Airlines organization, matching a dependency-confusion attack pattern.

    npmCompromised packageDependency confusion